Belkin Administrator Guide

Transcription

1 Sectin 1 - Intrductin Belkin Administratr Guide Belkin Administratr Guide Prducts cvered by this manual: Belkin Secure KVM, KM, and Windwing KVM Dc N: HDC10957 Rev: E

2 Table f Cntents Intrductin... 1 Intended Audience... 1 Revisin Histry... 1 Safety Precautins... 2 Safety Precautins (French)... 3 User Guidance & Precautins... 4 Administratr Cnfiguratin... 6 Terminal Mde Operatin... 7

3 Sectin 1 - Intrductin Intrductin This Administratr Guide prvides details t cnfigure, administer, and audit yur new prduct. Imprtant Security Nte: If yu are aware f ptential security vulnerabilities while installing r perating this prduct, we encurage yu t cntact us immediately in ne f the fllwing ways: gv_security@belkin.cm Tel: +1 (800) Nte that gv_security@belkin.cm is nt intended fr technical supprt. Intended Audience This dcument is intended fr the fllwing prfessinals: System Administratrs/IT Managers/Infrmatin Assurance Managers Revisin Histry A Initial Release, 11 June 2015 B Mdified Descriptin f lg events & User Guidance Updates, 16 June 2015 C Added Sectin n Admin Lgn, 13 August 2015 D Terminal Mde descriptin and clarity n menu chices, 15 February 2018 E Grammar and Spelling edits, 18 April 2018 Imprtant Anti-Tamper Indicatins: This prduct has tamper-evident security tape that will prvide visual indicatin f attempts t pen the enclsure. Further, the prduct is equipped with an always-n active anti-tamper mechanism. Any attempt t pen the enclsure will activate the anti-tamper trigger and render the unit permanently inperable. If the prduct s anti-tamper security tape appears disrupted r if all the channel LEDs flash cntinuusly, d nt install the unit and call Belkin Technical supprt at +1 (800) Imprtant nte befre deplying the prduct: T cmply with the prduct s Cmmn Criteria requirements and t prevent unauthrized administrative access, the default administratr passwrd must be changed prir t first use. Refer t Administratr Setup sectin fr further details. 1

4 Warnings & Precautins Safety Precautins Please read the fllwing safety precautins carefully befre using the prduct: Befre cleaning, discnnect the prduct frm any electrical pwer supply. D nt expse the prduct t excessive humidity r misture. D nt stre r use fr extensive perid in extreme thermal cnditins it may shrten prduct lifetime. Install the prduct nly n a clean, secure surface. If the prduct is nt used fr a lng perid f time, discnnect it frm electrical pwer. If any f the fllwing situatins ccurs, have the prduct inspected by a qualified service technician: Liquid penetrates the prduct s case. The prduct is expsed t excessive misture, water, r any ther liquid. The prduct is nt wrking well even after carefully fllwing the instructins in this administratr s manual. The prduct has been drpped r is physically damaged. The prduct shws bvius signs f breakage r lse internal parts. In case f external pwer supply If pwer supply verheats, is brken r damaged, r has a damaged cable. The prduct shuld be stred and used nly in temperature and humidity-cntrlled envirnments as defined in the prduct s envirnmental specificatins. Never attempt t pen the prduct enclsure. Any attempt t pen the enclsure will permanently disable the prduct. The prduct cntains a nn-replaceable internal battery. Never attempt t replace the battery r pen the enclsure. This prduct is equipped with always-n active anti-tampering system. Any attempt t pen the prduct enclsure will activate the anti-tamper triggers and render the unit inperable and warranty vid. 2

5 Warnings & Precautins Safety Precautins (French) Veuillez lire attentivement les précautins de sécurité suivantes avant d utiliser le prduit : Avant nettyage, débranchez l appareil de l alimentatin DC / AC. Assurez-vus de ne pas expser l appareil à une humidité excessive. Assurez-vus d installer l appareil sur une surface sécurisée prpre. Ne placez pas le crdn d alimentatin DC en travers d un passage. Si l appareil n est pas utilisé de lngtemps, retirez l alimentatin murale de la prise électrique. L appareil devra être rangé uniquement dans des envirnnements à humidité et température cntrôlées cmme défini dans les caractéristiques envirnnementales du prduit. L alimentatin murale utilisée avec cet appareil devra être du mdèle furni par le fabricant u un équivalent certifié furni par le fabricant u furnisseur de service autrisé. Si une des situatins suivantes survenait, faites vérifier l appareil par un technicien de maintenance qualifié : En cas d'alimentatin externe - L alimentatin de l appareil surchauffe, est endmmagée, cassée u dégage de la fumée u prvque des curts circuits de la prise du secteur. Un liquide a pénétré dans le bîtier de l appareil. L appareil est expsé à de l humidité excessive u à l eau. L appareil ne fnctinne pas crrectement même après avir suivi attentivement les instructins cntenues dans ce guide de l utilisateur. L appareil est tmbé u est physiquement endmmagé. L appareil présente des signes évidents de pièce interne cassée u desserrée L appareil cntient une batterie interne. La batterie n est pas remplaçable. N essayez jamais de remplacer la batterie car tute tentative d uvrir le bîtier de l appareil entraînerait des dmmages permanents à l appareil. Ce prduit est équipé d'tujurs-sur le système antisabtage active. Tute tentative d'uvrir le bîtier du prduit va activer le déclencheur anti-sabtage et de rendre l'unité vide inutilisable et garantie. 3

6 Warnings & Precautins User Guidance & Precautins Please read the fllwing User Guidance & Precautins befre using the prduct: 1. As the prduct pwers-up it perfrms a self-test prcedure. In case f a self- test failure, including jammed buttns, the prduct will be Inperable. A Self-test failure will be indicated by the fllwing LED behavir: a. Unit s anti-tamper mechanism has been activated: Unit will rapidly and cntinuusly switch channels b. Jammed buttn r ther failure t bt: Unit will slwly switch between channels. T exit a self-test failure state, pwer cycle the unit. If the prblem persists, cntact yur system administratr r Belkin technical supprt. 2. Prduct pwer-up and Reset t Factry Defaults: a. By default, after prduct pwer-up, the active channel will be cmputer #1, indicated by the applicable frnt panel buttn LED being lit. b. Prduct restre t factry defaults (RFD) functin is available by pressing the fllwing keybard key sequence: Left CTRL Left CTRL F11 r. c. RFD actin will be indicated by a single click d. When the prduct rebts after RFD, the cnsle keybard and muse will be mapped t the active channel #1 and default settings will be restred, erasing all user-set definitins. User Manual's apprpriate sectins. D nt cnnect any authenticatin device with an external pwer surce t the prduct. 4. Fr security reasns and per NIAP and Cmmn Criteria envirnmental requirements, prduct shuld never be used with wireless keybards and mice. 5. Fr security reasns and per NIAP and Cmmn Criteria envirnmental requirements, prducts shuld never be cnnected t a micrphne input. D nt cnnect a micrphne t the prduct audi utput prt, including headsets with micrphne inputs. The KVM is designed t prevent audi input signal flw. 6. The Prduct is equipped with always-n active antitampering system. Any attempt t pen the enclsure will activate the anti-tamper trigger, indicated by all channelselect LEDs flashing rapidly frm ne channel t the ther. In this case, prduct will be inperable. If the prduct s anti-tamper evidence tape appears disrupted r if all channel-select LEDs flash cntinuusly, remve prduct frm service immediately and cntact technical supprt. Imprtant: Fr change management tracking, it is advised t perfrm a quarterly lg check t verify that administratr accunts and lgn events can be verified. 3. The apprpriate usage f peripherals (e.g. keybard, muse, display, authenticatin device) is described in detail in the 4

7 Warnings & Precautins 7. In case a cnnected device is rejected in the cnsle prt grup the user will have the fllwing visual indicatins: a. When cnnecting a nn-qualified keybard, the keybard will be nn-functinal with n visible keybard strkes n screen when typing. b. When cnnecting a nn-qualified muse, the muse will be nn-functinal with muse cursr frzen n screen. c. When cnnecting a nn-qualified display, the vide diagnstic LED will flash green nce and turn ff, and vide will nt display n mnitr. d. When cnnecting a nn-qualified CAC reader (n mdels with a dedicated CAC prt), the USB LED will flash green nce and turn ff, CAC reader will be inperable. 8. D nt cnnect prduct t cmputing devices: a. That are TEMPEST cmputers b. That include telecmmunicatin equipment c. That include frame grabber vide cards d. That include special audi prcessing cards 12. Administratr authenticatin sessin is terminated nly when unit is pwer-cycled. Once all administrative tasks have been cmpleted, pwer cycle the unit t exit administratr-authenticated mde. Reprting Belkin Prduct Security Vulnerabilities: 1. If the prduct s anti-tamper evidence tape appears disrupted r if all channel-select LEDs flash cntinuusly, please remve prduct frm service immediately and cntact Belkin Technical Supprt. 2. If yu are aware f ptential security vulnerabilities with any Belkin secure KM/KVM prduct, we encurage yu t cntact us immediately at gv_security@belkin.cm r ur technical supprt line at Nte: The Gv_Security@belkin.cm address is nt intended fr technical supprt. 9. The Prduct has a remte-cntrl prt n the back panel labeled DCU. Only the ptinal Belkin supplied desktp cntrller unit can be used with this prt. 10. Imprtant! After re-allcating cmputers t channels, it is mandatry t pwer cycle the prduct, keeping it pwered OFF fr mre than 1 minute. 11. The prduct lg access and administratr cnfiguratin ptins are described starting in the next sectin. 5

8 Administratr Cnfiguratin Administratr Cnfiguratin The prduct nly maintains a lg f security-related functins that can be cnfigured. Lgs can be viewed nly by authenticated administratrs. Nte that the ne-time-prgrammable (OTP) lg data may nt be erased, and the lg functin may nt be disabled by users r administratrs. Als nte that the unit ships with a default (rt) admin accunt and requires that the default passwrd be changed upn first bt. Additinal admin accunts can be created by the rt administratr; hwever, an RFD will delete these accunts. Rt admin accunt and new passwrd will nt be affected by an RFD. Imprtant nte befre deplying the prduct: T cmply with the prduct s Cmmn Criteria requirements and t prevent unauthrized administrative access, the default administratr passwrd must be changed prir t first use. Administratr Setup a. Cnnect keybard, muse and ne USB cable between the KVM and the cmputer and pwer up the prduct. Nte that the display may r may nt be cnnected thrugh the prduct. b. Select channel #1 n the prduct and pen Ntepad n the cmputer cnnected t channel #1. c. Using keybard, type CTRL (Left), CTRL (Right), t t enter Admin Mde. d. Text will appear in Ntepad asking fr a user name. e. The default user name is: admin1234. This accunt ID cannt be changed r deleted. f. The default first device lgn passwrd is: 1234ABCDefg!@# g. At first lgn the administratr must set a new, nndefault, passwrd. The new passwrd must be at least: a. 8 characters lng but nt lnger than 24 characters; b. Have at least ne capital and ne lwer-case letter c. Have at least ne number; d. Have at least ne symbl. h. Passwrd must be typed twice t cnfirm. i. Passwrd may be changed at any time. j. RFD will nt reset the default user name and passwrd! k. If the default user name r passwrd is frgtten cntact Belkin supprt. l. Nte: The unit will enter tamper mde after 4 failed attempts t lgin. T reset, pwer cycle the unit and attempt again. m. Additinal administrative user accunts can be created frm the terminal menu (up t 8 mre in additin t the default admin accunt per unit). a. Admin names need t include at least 1 capital and 1 lwer case letter and 1 number. 6

9 Administratr Cnfiguratin Terminal Mde Operatin Once authenticated the fllwing menu will be presented: Authenticatin succeeded. Please select peratin asset management 1 - firmware versins 2 - cnfigure dpp (inperable used nly in prductin) 3 - cnfigure sc (allws cnfiguratin f KM functinality) 4 - accunt management 5 - reset t factry defaults 6 - lgs and events 8 - back 9 - exit terminal mde The administartr will be able t select any f the ptins by selecting the number n the keybard (nte that the keypad is disabled). User can exit ut f Admin mde but remain as an authenticated administratr by selecting 9 as seen in the abve menu. Hwever, t exit authenticated administratr mde, unit must be pwer cycled. Imprtant: Pwer cycle the unit after cmpleting administrative tasks t exit cnfiguratin mde. Nte: As lng as the unit is in Admin mde key strkes will nt be sent t the target cmputer. Nte: Selectin #2 is used during the prductin prcess t activate the unit. This has n functin pst prductin. Item #3 (SC Cnfiguratin) is used t cnfigure Keybard/Muse (KM) functins fr units that are prgrammed t be a KM switch and shuld nt be used fr KVM switches. Asset Management (0) The asset management sectin allws the administratr t change the USB parameters that the KVM switch will use t identify itself t t an asset tracking system. Administratrs can select t use a standard descriptr, a custm descriptr, enter a new asset tag, display the asset tag, r apply the asset tag. Firmware Versins (1) The firmware versins sectins allws the administratr t check the different firmware versins laded n the different cntrllers f the KVM switch. Administratrs can check the Device Emulatr (de) versin, System Cntrller (sc) versin, r CAC cntrller (dpp) versin. vc is reserved fr prductin use nly and has n functin nce unit has been prduced. Accunt Management (4) Add and remve administratrs as well as change passwrds. Accunt user IDs require 1 capital, 1 lwer case, and 1 numeral. Passwrds must be between 8 and 24 characters lng and cntain at least 1 capital, 1 lwer case, 1 number, and ne symbl. When deleting accunts, pwer cycle the unit befre adding new accunts. 7

10 Administratr Cnfiguratin Reset t Factry Defaults (5) Reset the device t factry default. This is a cmplete reset that will nt reset the rt Admin user name and passwrd, and the lg. It will delete all secndary admin accunts and passwrds as well as reset cnfigurable functins t factry defaults. Lgs and Events (6) Lgs cnsist f critical and nn-critical infrmatin. Unit lgs thse aspects deemed by NIAP as impacting the security aspects f the prduct. As the Belkin secure peripheral switches are strictly restricted in their flexibility t minimize the attack surface, 1. Critical Lg Infrmatin (OTP): stres and presents the fllwing infrmatin: a. Administratr accunt creatin events b. Passwrd Change events 2. RAM Lg a. Held in vlatile memry that will ver-write itself and delete upn pwer cycling. b. Infrmatin n USB peripheral rejectin events, failed lg-n events 8

11 Administratr Cnfiguratin Imprtant Anti-Tamper Indicatins: This prduct has tamper-evident security tape that will prvide visual indicatin f attempts t pen the enclsure. Further, the prduct is equipped with an always-n active anti-tamper mechanism. Any attempt t pen the enclsure will activate the anti-tamper trigger and render the unit permanently inperable. If the prduct s anti-tamper security tape appears disrupted r if all the channel LEDs flash cntinuusly, d nt install the unit and call Belkin Technical supprt at +1 (800)